paperclipai/paperclip · error · PaperclipRunnerProviderProfileError

paperclip_runner_claude_managed_recovery_secret_mismatch

paperclip_runner_claude_managed_recovery_secret_mismatch

Error message

The persisted Claude Managed run is not bound to its profile's current API-key secret.

What it means

Guard assertManagedProfileRecoveryBinding: beyond identity fields, the persisted Claude Managed run must be bound to the profile's current API-key secret; when the adapter-config binding record no longer matches the profile's apiKeySecretId, the error 'paperclip_runner_claude_managed_recovery...' is thrown. Fires after the profile's API key was rotated or re-created, invalidating recovery of in-flight runs.

Source

Thrown at server/src/services/native-runtime/provider-profile.ts:236

  };
}): void {
  const { snapshot, stored } = input;
  if (
    snapshot.profileId !== stored.id
    || snapshot.anthropicAgentId !== stored.anthropicAgentId
    || snapshot.agentVersion !== stored.agentVersion
    || snapshot.environmentId !== stored.environmentId
    || snapshot.betaVersion !== stored.betaVersion
  ) {
    throw new PaperclipRunnerProviderProfileError(
      "paperclip_runner_claude_managed_recovery_identity_mismatch",
      "The persisted Claude Managed identity no longer matches its qualified profile.",
    );
  }
  const rawBinding = asRecord(asRecord(input.adapterConfig).env).ANTHROPIC_API_KEY;
  const boundSecretId = asRecord(rawBinding).secretId;
  if (boundSecretId !== stored.apiKeySecretId) {
    throw new PaperclipRunnerProviderProfileError(
      "paperclip_runner_claude_managed_recovery_secret_mismatch",
      "The persisted Claude Managed run is not bound to its profile's current API-key secret.",
    );
  }
}

/** Revalidate the operator's AWS profile revocation and immutable identity on recovery. */
export function assertAgentCoreProfileRecoveryBinding(input: {
  snapshot: {
    profileId: string;
    region: string;
    accountId: string;
    harnessArn: string;
    harnessVersion: string;
    endpointArn: string;
    endpointQualifier: string;
    agentRuntimeArn: string;
    memoryArn: string;

View on GitHub (pinned to 01ad858492)

Solutions

1. Re-bind the run to the profile's current API-key secret by re-qualifying and starting a fresh run.
2. Restore the previously bound secret if rotation was accidental.
3. Update the stored binding record to the new secret id through the supported profile-management flow before resuming.

When it happens

Trigger: Thrown at server/src/services/native-runtime/provider-profile.ts:230 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-09-02). Data as JSON: /api/errors/91007a7395f8e8fd. Report an issue: GitHub.